7 ms·

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to acce

I don't understand why internet access isn't opt-in for apps. Preventing exfiltration would prevent much of this harm, and most apps don't have any need to access the internet in the first place. Why am I creating a GE account to read my blood pressure? At least I know it's taking advantage of me. But this is clearly abusive behavior

hellcow 4mo ago
GrapheneOS lets you restrict the internet access of any app on install. But yes, agreed it should be everywhere.
- Cider9986 4mo ago
  Yeah it asks on app install if you want to grant network permissions. It's just a little checkbox. You can of course manage it afterwards in app settings or permissions manager. They also added the sensors permission.
- backscratches 4mo ago
  And you can limit which contacts you share with nosy app like WhatsApp, and give access to only specific scope of file folders. Horrifying to think all the years every app got everything it wanted and did not have to ask and couldn't be stopped (I had a rooted phone for firewall capability for a while )
- microtonal 4mo ago
  See my comment upthread, it helps a bit, but does not close this hole since apps within the same profile can communicate through IPC, so other apps could provide network access on their behalf. I think the best example is probably Play Services, which provides functionality for a lot of apps and will communicate with Google, etc. (Yes, you can disable network access to Play Services, but it sometimes breaks things and the general point of IPC as a hole still stands.)
  - deanishe 4mo ago
    I'm not an Android user. What's a profile? Is that a user thing or a developer thing?
    - microtonal 4mo ago
      It is a user thing, you can set up multiple profiles and install apps into each of them. These profiles are isolated from each other. I think they started out as a way of separating private and work apps/data, but you can have many of them. See e.g.: https://grapheneos.org/features#improved-user-profiles https://grapheneos.org/features#improved-user-profiles
    - Cider9986 4mo ago
      You can make different profiles. They can have different unlock methods and can have different apps installed. If you have one app installed in both it's shared. They were designed so multiple people could use one device. Some people use them to separate identities or contain apps they view as bad. I'm not sure if the efficacy of this. Grapheneos improves them significantly https://grapheneos.org/features#improved-user-profiles https://grapheneos.org/features#improved-user-profiles
    - inigyou 4mo ago
      On GrapheneOS, it's like a container, or a virtual phone. Apps in different profiles (and you can install the same app in more than one profile) can't see each other and theoretically can't even tell they're running on the same phone (although I'm sure there are leaks like IP address)
- iLoveOncall 4mo ago
  iOS lets you turn off data access (so outside of wifi) for apps as well, it's just not asked at install, which honestly makes sense given the demographics of iPhone users.
  - DavideNL 4mo ago
    Which is useless for 99% of users since they use Wi-Fi at some point in the entire phones lifetime….
- nubinetwork 4mo ago
  You don't need graphene for this, I've been able to do this on plain android for ages.
deleted 4mo ago
[deleted]
gyomu 4mo ago
Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.
- Cider9986 4mo ago
  This isn't effective because Little Snitch only sees the domains so apps can just serve the trackers on the same domain as essential services making blocking impossible. The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.
  - gyomu 4mo ago
    I derive lots of value from Little Snitch on my Mac, so this approach is more effective than not having anything. And yes, having the ability to deny any app network access on iOS would be great.
    - amelius 4mo ago
      Yeah but it might be because you are part of a minority. Once/if this is built into the OS, the app builders will have a strong incentive to do things differently.
  - inigyou 4mo ago
    Can, but they don't, because app developers are just as lazy and don't waste time to hide their trackers
    - saagarjha 4mo ago
      Yet.
    - 360MustangScope 4mo ago
      They don’t because there is no reason to currently. If this was added then they would have a reason to and do it. YouTube used to be separate domains for ads and then it got merged together so that you can’t block the ads network wide without blocking YouTube videos.
reorder9695 4mo ago
AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.
- microtonal 4mo ago
  It's nice to be able to toggle it (it's also possible to revoke this permission on GrapheneOS). However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. I would guess that Play Services is one of the larger offenders, since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play Services does work that involves internet access on behalf of other apps. You could of course disable network access to Play Services, but at least for me that broke a bunch of apps or made them unreliable. What AOSP ROMs need besides the network permission toggle is IPC scopes functionality, akin to storage scopes.
  - ignoramous 4mo ago
    > However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. Folks brings up 'IPC' as if this is some chink in the armour in AOSP. It isn't. 'Apps' pretty much on most consumer OSes can 'IPC' their way with other co-operating apps to 'achieve' network access from behind a firewall, just the same. > since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play Services does work that involves internet access on behalf of other apps If the OS or its privileged component will fchown the socket to the origin app, think the INTERNET permission will be enforced as expected.
    - saagarjha 4mo ago
      There is very little IPC that is allowed for apps that do not share a development team on iOS.
fizwidget 4mo ago
Because 99% of apps would request it & not function without it, desensitising users into blindly accepting it. Most apps do have a legitimate reason for accessing the internet, so a binary yes/no wouldn’t achieve much anyway. I just don’t think it’s an effective way of solving the problem.
- fauigerzigerk 4mo ago
  100% of users have legitimate reasons to block internet access for some apps. If internet access wasn't granted by default, a lot more apps would function without it. Many other apps wouldn't exist at all, because their only reason to exist is to spy on users.
  - tokioyoyo 4mo ago
    Not going to lie, it would be an absolute hell to develop an app that's actually used without getting crash/analytics.
    - throwaway27448 4mo ago
      Surely this could (or should) be facilitated through the app store.
      - BergaDev 4mo ago
        That'd just be kicking up another lawsuit for giving app stores too much control
    - AlecSchueler 4mo ago
      Sounds like normal development up until ten years ago. Somehow we managed.
      - tokioyoyo 4mo ago
        10 years ago we already had the same tools. 15 years ago they were starting up. If you wanna go further, 20 years ago we didn’t have that much of distribution, users, or differences in software/hardware. Shipping speeds were also much slower.
henryhchchc 4mo ago
iPhones purchased in mainland China (with model number ending in CH/A) do provide options for setting per-app Internet access permissions. There are three options [0]: Off, WLAN only, WLAN and Cellular. [0] https://old.reddit.com/r/ios/comments/aib10i/in_china_ios_allows_you_to_turn_off_mobile_data/ https://old.reddit.com/r/ios/comments/aib10i/in_china_ios_al...
- ksec 4mo ago
  What? Why is this Chinese market only? This is exactly what I wanted. There are Apps I simply don't want them to touch internet.
  - thewebguyd 4mo ago
    Its Chinese market only because of regulation. China mandates it. Don't implement it = you don't get to sell in China. If Apple wanted to provide this willingly they would. That its only available in China due to government regulation tells you all you need to know.
    - tancop 4mo ago
      i got an old EU market redmi (yes im broke) and you can turn off either wifi or cellular or both for any non system app. remember apple had to put in work to actively block the feature outside of china.
- throwaway27448 4mo ago
  Crazy. So they're explicitly selling crippled devices to most of the world.
- firexcy 4mo ago
  Many Chinese users actually hate this feature because of how it's designed. There's a mandatory pop-up upon the first launch of every app to ask for your choice, which can be clumsy if you're setting up a new device. If you tap the wrong option (which is common since the dialog is small and crowded), you have to go deep into system settings to restore internet access. Moreover, many foreign app developers know nothing of this and have their apps throw an error even before a Chinese user has the chance to give permission, forcing them to manually kill and reopen the app to be online, adding to the errands.
mazzystar 4mo ago
This resonates from the dev side. I made an offline photo search app a while back — you search your library in plain language ("a boy and a girl by the river"), CLIP embeddings all computed on device. It needs full photo access but I deliberately requested zero network permission. Was kind of proud of that. Problem is there's no way for users to actually know that. iOS has no "this app can't reach the internet" indicator, so the whole guarantee is invisible. I even had people assume the opposite — app reads your whole library, therefore it must be uploading it somewhere. Exactly backwards.
- subscribed 4mo ago
  Fantastic work. I regret I can't use it, because this is exactly what I'm looking for for quite a while, but it seems to be an impossible task (I need it on android).
lapcat 4mo ago
Curiously, the Mac App Store sandbox has a com.apple.security.network.client entitlement that a developer must justify to Apple, whereas the iOS App Store does not, allowing unrestricted access to the internet.
nobody42 4mo ago
Because exposed, non-private, abused by-default is a business model. The company is incentivised to not provide restricted access - otherwise you can't have a cut from apps revenue. It's defective by design.
- Barbing 4mo ago
  Shocked to see iPhones sold in China are less defective by design on this one point, from another comment. It has surely reduced Genius Bar visits but it’s also harmed my privacy.
nashashmi 4mo ago
The evolution of development was to make things easy and simple for the consumer. If internet was an opt-in (and it cannot be opt-out), then app function would be ostensibly limited. And the user would be given a harder time setting things up. This is the Apple mindset. Make things easy. Do not make things complicated.
- throwaway27448 4mo ago
  The attitude was never "don't give the user control", though. Until ios.
nodamage 4mo ago
> most apps don't have any need to access the internet in the first place Citation needed. Looking through my phone the vast majority of third party apps I have installed obviously require internet access: - Social media - Travel (rideshare/airlines/hotels) - Streaming - Finance (credit cards/banks) - Shopping Not counting built-in apps like the calculator I'd estimate 80-90% of the apps I have installed require internet access.
- coffeecoders 4mo ago
  It's a selection bias issue. The categories you have listed are essentially web services wrapped in an app shell. Of course they need the internet. Consider these examples: - Photo/Video editors - Snapsheed, Lightroom, Video trimmers etc. - Document readers & scanners - PDF viewers, e-readers, OCR scanners - Note taking - Obsidian - File/Password managers - Authenticators etc. - Single player games - Chess, puzzles etc. - Audio/Video players - VLC players We've just become conditioned to accept that every app needs to phone home for tracking and ad-delivery.
  - jamessb 4mo ago
    A photo/video editor may include the ability to upload images to a sharing service/social media. PDF viewers (like GoodReader) can download a PDF from a URL, or read it from a network drive. Obsidian has functions that need internet access (e.g., connecting to the Obsidian sync servers, installing community plugins). Password managers often have a sync feature. A video player may be able to play files hosted on remote servers or network drives. They should be useable without an internet connection, but it's entirely reasonable for them to request permissions for network access.
  - nodamage 4mo ago
    Most of what you've listed I do on my computer not my phone. And some of your items do require internet for useful purposes (at the very least backup and syncing for notes/passwords).
- deleted 4mo ago
  [deleted]
yftsui 4mo ago
iPhones sold in China have that in settings, you can block both WLAN(Wi-Fi) and Cellular data per app. Why that turned out to be a nightmare is a different story
- fragmede 4mo ago
  What's the story?
dessimus 4mo ago
>most apps don't have any need to access the internet in the first place. It would severely depend on how you categorize "most apps" because I would say I pretty much only use apps that need the Internet, barring Calculator, Camera, and a PDF reader (only because I prefer how it zooms books vs browser. Everything else implicitly needs the Internet as that app is just a better UI to using their mobile web site, if they even offer one.
- throwaway27448 4mo ago
  Apps are more than just a gateway to content. Your phone is also useful as a tool in itself. Most health, hardware, creative, and productivity apps do not need access to the internet. Even downloading, say, content packs could be done via icloud if apple cared about privacy. Syncing with icloud and not some rando company's probably insecure webapp is a great deal of the appeal of an app store in the first place.
st3fan 4mo ago
It is opt-in on iOS for Applications. Applications have to declare upfront what sites they will communicate with. It is called app transport security. if you don't set it up your app boots in a sandbox with no network. Settings -> Privacy Security -> App Privacy Report Unfortunately 1 - as a _user_ you cannot opt-in or out. I wish Apple would take the next step and let us select which sites an app is not allowed to communicate with. Or ideally even globally for all apps. Unfortunately 2 - the list of sites the app wants to communicate with is not clearly communicated upfront like before you install. Unfortunately 3 - the list can also contain wildcard domains Small steps - they really need to push this to the next phase IMO.

hellcow 4mo ago

GrapheneOS lets you restrict the internet access of any app on install. But yes, agreed it should be everywhere.

Cider9986 4mo ago
Yeah it asks on app install if you want to grant network permissions. It's just a little checkbox. You can of course manage it afterwards in app settings or permissions manager. They also added the sensors permission.
backscratches 4mo ago
And you can limit which contacts you share with nosy app like WhatsApp, and give access to only specific scope of file folders. Horrifying to think all the years every app got everything it wanted and did not have to ask and couldn't be stopped (I had a rooted phone for firewall capability for a while )
microtonal 4mo ago
See my comment upthread, it helps a bit, but does not close this hole since apps within the same profile can communicate through IPC, so other apps could provide network access on their behalf. I think the best example is probably Play Services, which provides functionality for a lot of apps and will communicate with Google, etc. (Yes, you can disable network access to Play Services, but it sometimes breaks things and the general point of IPC as a hole still stands.)
- deanishe 4mo ago
  I'm not an Android user. What's a profile? Is that a user thing or a developer thing?
  - microtonal 4mo ago
    It is a user thing, you can set up multiple profiles and install apps into each of them. These profiles are isolated from each other. I think they started out as a way of separating private and work apps/data, but you can have many of them. See e.g.: https://grapheneos.org/features#improved-user-profiles https://grapheneos.org/features#improved-user-profiles
  - Cider9986 4mo ago
    You can make different profiles. They can have different unlock methods and can have different apps installed. If you have one app installed in both it's shared. They were designed so multiple people could use one device. Some people use them to separate identities or contain apps they view as bad. I'm not sure if the efficacy of this. Grapheneos improves them significantly https://grapheneos.org/features#improved-user-profiles https://grapheneos.org/features#improved-user-profiles
  - inigyou 4mo ago
    On GrapheneOS, it's like a container, or a virtual phone. Apps in different profiles (and you can install the same app in more than one profile) can't see each other and theoretically can't even tell they're running on the same phone (although I'm sure there are leaks like IP address)
iLoveOncall 4mo ago
iOS lets you turn off data access (so outside of wifi) for apps as well, it's just not asked at install, which honestly makes sense given the demographics of iPhone users.
- DavideNL 4mo ago
  Which is useless for 99% of users since they use Wi-Fi at some point in the entire phones lifetime….
nubinetwork 4mo ago
You don't need graphene for this, I've been able to do this on plain android for ages.

deleted 4mo ago

[deleted]

gyomu 4mo ago

Better yet, a tool like Little Snitch should be built into the OS. Give me a detailed log of every network requests, to which domains, with what data.

Cider9986 4mo ago
This isn't effective because Little Snitch only sees the domains so apps can just serve the trackers on the same domain as essential services making blocking impossible. The only way to prevent malicious apps from affecting your privacy is to not install them or not give them network access.
- gyomu 4mo ago
  I derive lots of value from Little Snitch on my Mac, so this approach is more effective than not having anything. And yes, having the ability to deny any app network access on iOS would be great.
  - amelius 4mo ago
    Yeah but it might be because you are part of a minority. Once/if this is built into the OS, the app builders will have a strong incentive to do things differently.
- inigyou 4mo ago
  Can, but they don't, because app developers are just as lazy and don't waste time to hide their trackers
  - saagarjha 4mo ago
    Yet.
  - 360MustangScope 4mo ago
    They don’t because there is no reason to currently. If this was added then they would have a reason to and do it. YouTube used to be separate domains for ads and then it got merged together so that you can’t block the ads network wide without blocking YouTube videos.

reorder9695 4mo ago

AOSP has network as a regular permission for apps, so on Lineage at least (idk about Graphene as I haven't used it) you can disable network for any app including google play services etc. I have no idea why most phone companies remove this permission from their roms but android itself supports it perfectly fine.

microtonal 4mo ago
It's nice to be able to toggle it (it's also possible to revoke this permission on GrapheneOS). However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. I would guess that Play Services is one of the larger offenders, since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play Services does work that involves internet access on behalf of other apps. You could of course disable network access to Play Services, but at least for me that broke a bunch of apps or made them unreliable. What AOSP ROMs need besides the network permission toggle is IPC scopes functionality, akin to storage scopes.
- ignoramous 4mo ago
  > However, it is imperfect, since apps within the same profile can still communicate through IPC, so if apps cooperate, network access can still be achieved. Folks brings up 'IPC' as if this is some chink in the armour in AOSP. It isn't. 'Apps' pretty much on most consumer OSes can 'IPC' their way with other co-operating apps to 'achieve' network access from behind a firewall, just the same. > since many apps communicate with Play Services and as far as I understand (but I may be mistaken) Play Services does work that involves internet access on behalf of other apps If the OS or its privileged component will fchown the socket to the origin app, think the INTERNET permission will be enforced as expected.
  - saagarjha 4mo ago
    There is very little IPC that is allowed for apps that do not share a development team on iOS.

fizwidget 4mo ago

Because 99% of apps would request it & not function without it, desensitising users into blindly accepting it. Most apps do have a legitimate reason for accessing the internet, so a binary yes/no wouldn’t achieve much anyway. I just don’t think it’s an effective way of solving the problem.

fauigerzigerk 4mo ago
100% of users have legitimate reasons to block internet access for some apps. If internet access wasn't granted by default, a lot more apps would function without it. Many other apps wouldn't exist at all, because their only reason to exist is to spy on users.
- tokioyoyo 4mo ago
  Not going to lie, it would be an absolute hell to develop an app that's actually used without getting crash/analytics.
  - throwaway27448 4mo ago
    Surely this could (or should) be facilitated through the app store.
    - BergaDev 4mo ago
      That'd just be kicking up another lawsuit for giving app stores too much control
  - AlecSchueler 4mo ago
    Sounds like normal development up until ten years ago. Somehow we managed.
    - tokioyoyo 4mo ago
      10 years ago we already had the same tools. 15 years ago they were starting up. If you wanna go further, 20 years ago we didn’t have that much of distribution, users, or differences in software/hardware. Shipping speeds were also much slower.

henryhchchc 4mo ago

iPhones purchased in mainland China (with model number ending in CH/A) do provide options for setting per-app Internet access permissions. There are three options [0]: Off, WLAN only, WLAN and Cellular. [0] https://old.reddit.com/r/ios/comments/aib10i/in_china_ios_allows_you_to_turn_off_mobile_data/ https://old.reddit.com/r/ios/comments/aib10i/in_china_ios_al...

ksec 4mo ago
What? Why is this Chinese market only? This is exactly what I wanted. There are Apps I simply don't want them to touch internet.
- thewebguyd 4mo ago
  Its Chinese market only because of regulation. China mandates it. Don't implement it = you don't get to sell in China. If Apple wanted to provide this willingly they would. That its only available in China due to government regulation tells you all you need to know.
  - tancop 4mo ago
    i got an old EU market redmi (yes im broke) and you can turn off either wifi or cellular or both for any non system app. remember apple had to put in work to actively block the feature outside of china.
throwaway27448 4mo ago
Crazy. So they're explicitly selling crippled devices to most of the world.
firexcy 4mo ago
Many Chinese users actually hate this feature because of how it's designed. There's a mandatory pop-up upon the first launch of every app to ask for your choice, which can be clumsy if you're setting up a new device. If you tap the wrong option (which is common since the dialog is small and crowded), you have to go deep into system settings to restore internet access. Moreover, many foreign app developers know nothing of this and have their apps throw an error even before a Chinese user has the chance to give permission, forcing them to manually kill and reopen the app to be online, adding to the errands.

mazzystar 4mo ago

This resonates from the dev side. I made an offline photo search app a while back — you search your library in plain language ("a boy and a girl by the river"), CLIP embeddings all computed on device. It needs full photo access but I deliberately requested zero network permission. Was kind of proud of that. Problem is there's no way for users to actually know that. iOS has no "this app can't reach the internet" indicator, so the whole guarantee is invisible. I even had people assume the opposite — app reads your whole library, therefore it must be uploading it somewhere. Exactly backwards.

subscribed 4mo ago
Fantastic work. I regret I can't use it, because this is exactly what I'm looking for for quite a while, but it seems to be an impossible task (I need it on android).

lapcat 4mo ago

Curiously, the Mac App Store sandbox has a com.apple.security.network.client entitlement that a developer must justify to Apple, whereas the iOS App Store does not, allowing unrestricted access to the internet.

nobody42 4mo ago

Because exposed, non-private, abused by-default is a business model. The company is incentivised to not provide restricted access - otherwise you can't have a cut from apps revenue. It's defective by design.

Barbing 4mo ago
Shocked to see iPhones sold in China are less defective by design on this one point, from another comment. It has surely reduced Genius Bar visits but it’s also harmed my privacy.

nashashmi 4mo ago

The evolution of development was to make things easy and simple for the consumer. If internet was an opt-in (and it cannot be opt-out), then app function would be ostensibly limited. And the user would be given a harder time setting things up. This is the Apple mindset. Make things easy. Do not make things complicated.

throwaway27448 4mo ago
The attitude was never "don't give the user control", though. Until ios.

nodamage 4mo ago

> most apps don't have any need to access the internet in the first place Citation needed. Looking through my phone the vast majority of third party apps I have installed obviously require internet access: - Social media - Travel (rideshare/airlines/hotels) - Streaming - Finance (credit cards/banks) - Shopping Not counting built-in apps like the calculator I'd estimate 80-90% of the apps I have installed require internet access.

coffeecoders 4mo ago
It's a selection bias issue. The categories you have listed are essentially web services wrapped in an app shell. Of course they need the internet. Consider these examples: - Photo/Video editors - Snapsheed, Lightroom, Video trimmers etc. - Document readers & scanners - PDF viewers, e-readers, OCR scanners - Note taking - Obsidian - File/Password managers - Authenticators etc. - Single player games - Chess, puzzles etc. - Audio/Video players - VLC players We've just become conditioned to accept that every app needs to phone home for tracking and ad-delivery.
- jamessb 4mo ago
  A photo/video editor may include the ability to upload images to a sharing service/social media. PDF viewers (like GoodReader) can download a PDF from a URL, or read it from a network drive. Obsidian has functions that need internet access (e.g., connecting to the Obsidian sync servers, installing community plugins). Password managers often have a sync feature. A video player may be able to play files hosted on remote servers or network drives. They should be useable without an internet connection, but it's entirely reasonable for them to request permissions for network access.
- nodamage 4mo ago
  Most of what you've listed I do on my computer not my phone. And some of your items do require internet for useful purposes (at the very least backup and syncing for notes/passwords).
deleted 4mo ago
[deleted]

yftsui 4mo ago

iPhones sold in China have that in settings, you can block both WLAN(Wi-Fi) and Cellular data per app. Why that turned out to be a nightmare is a different story

fragmede 4mo ago
What's the story?

dessimus 4mo ago

>most apps don't have any need to access the internet in the first place. It would severely depend on how you categorize "most apps" because I would say I pretty much only use apps that need the Internet, barring Calculator, Camera, and a PDF reader (only because I prefer how it zooms books vs browser. Everything else implicitly needs the Internet as that app is just a better UI to using their mobile web site, if they even offer one.

throwaway27448 4mo ago
Apps are more than just a gateway to content. Your phone is also useful as a tool in itself. Most health, hardware, creative, and productivity apps do not need access to the internet. Even downloading, say, content packs could be done via icloud if apple cared about privacy. Syncing with icloud and not some rando company's probably insecure webapp is a great deal of the appeal of an app store in the first place.

st3fan 4mo ago

It is opt-in on iOS for Applications. Applications have to declare upfront what sites they will communicate with. It is called app transport security. if you don't set it up your app boots in a sandbox with no network. Settings -> Privacy Security -> App Privacy Report Unfortunately 1 - as a _user_ you cannot opt-in or out. I wish Apple would take the next step and let us select which sites an app is not allowed to communicate with. Or ideally even globally for all apps. Unfortunately 2 - the list of sites the app wants to communicate with is not clearly communicated upfront like before you install. Unfortunately 3 - the list can also contain wildcard domains Small steps - they really need to push this to the next phase IMO.